ISE Client provisioning portal Cert error

[Steven Williams]

When a client connects to the network and or VPN they do to hit ISE for posture scan, but always prompted its an untrusted server. The Issue I am going to have is I will have PCs connecting to this from 2 different forests and contractors that do not have company issued laptops so they will get a prompt also. So are people using third party certs for their provisioning portals and guest wifi portals?

[Jason Kunst · Accepted solution]

Yes you would need a well known cert to get around these issues

admin guide
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_0111.html#concept_8ECCCAF1252E40DDB9A786C0AC7BC3B2


Guest guide
https://community.cisco.com/t5/security-documents/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475

BYOD guide
https://community.cisco.com/t5/security-documents/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867#toc-hId--378753853

Certificate guide 

https://community.cisco.com/t5/security-documents/how-to-implement-digital-certificates-in-ise/ta-p/3630897

[Steven Williams]

I figured. I mean thats probably the best way anyway.

[Steven Williams]

Maybe I am missing it but when I get a third party cert from like verisign where is the section to create the cert request?

[Ben Walters]

You should be able to generate the CSR by going to Administration > Certificates > Certificate Signing Requests > Generate Certificate Signing Request (CSR) in ISE. 

[Steven Williams]

Back to this for a min. Unless I had a wildcard trusted third party cert I would need an individual cert for every portal I want to protect with ssl correct? So if I have a password portal called passwordreset.domain.com and a client provisioning portal called client.domain.com I would need to certs? How do I generate the csr for each one?

[Steven Williams]

Generate Multiuse cert with FQDN and multiple SANs with what you want the portal URIs to be.

[Pranav Mhatre]

Hello Experts,

We have upload CA cert in ISE and same cert in Machine trusted list too. We r using Mschapv2 for authentication and Posture to check AV status.

But when user gets captive portal, Browser shows untrusted cert error even if cert is present in Browser's trust list.

Is there any specific check that we need to perform in ISE while generating CSR or any setting on Laptop?